(This was previously the 'Does anyone recognise this extended instruction set?' thread, but the title became obsolete so I'm starting a new one!)

So I've got one of these.



AFAICT this is the French version of the My Zone toy laptop. It plays a variety of dubiously educational games while playing terrible music and farmyard animal noises at high volume, plus a lot of sampled speech. The screen is greyscale, probably 4-bit. Inside it's got an unlabelled blob chip and an 8-pin SPI flash chip. I've removed and socketed the chip, and am now running my own code on it.

So far I know that:

- it uses the 65c02 instruction set.
- the SPI flash is memory mapped at 0x8000-0xefff, in 32kB banks. The chip itself is 2MB giving it masses of space. It can read and execute a byte from flash in 7us, which gives it a simulated clock speed of 140kHz. I suspect the CPU runs much faster than this and it's waiting for the flash. The bank register is 0x0a38.
- there's an internal ROM from 0x0b80 to 0x7fff, and from 0xf000 to 0xffff. I think this is also banked, but the bank register is much less obvious.
- RAM extends from 0x0000 up to, I think, 0x09ff.
- I/O ports are in 0x0a00 to 0x0aff.
- The screen is probably 64x32, but that would take 512 bytes of RAM. I've seen several routines which look they're drawing on the screen, but they're only writing to 0x0b00 to 0x0b7f, which isn't big enough. Maybe that's banked too? Or I might be looking at sound processor routines.

My guess is that the internal ROM contains an operating system plus all the common routines for doing audio, drawing on the screen, etc, and the slow SPI flash contains the audio and graphics assets, top-level code for the various applets etc --- that way they can reuse the same blob with multiple SPI flash payloads for different products.

I believe this thing is one of the ubiquitous GeneralPlus electronic toy chips, as made famous by the Tamagotchi. But, all the chips supported by the GeneralPlus IDE have their I/O at 0x3000, which doesn't match this one. It's quite possible that VTech are big enough to negotiate a custom processor from GeneralPlus, or maybe I'm just wrong.

I'm writing all this down because I'm going to have to take a break for a few days, and I'm sure I will forget everything when I get back... plus, someone might recognise this!

The main story here is surely going to be the disassembly and the figuring out of the memory mapping. But...

Removed and socketed a blob - that sounds quite tricky, unless perhaps the blob was already on a carrier board... interested to hear more.

While I would love to be able to do that flex, sadly I only socketed the 8-pin flash chip. Even that was right at the limits of my soldering ability (I lifted a pad and was very, very lucky to be able to bodge around it with magnet wire). I don't think anyone's managed to remove a blob chip and have it still work afterwards!

ah! Of course, it's the flash that holds the secrets. Silly me.

Can the CPU write to flash, so you could dump the contents of the internal ROM?

I haven't tried. Probably, but I may have to do raw SPI commands.

I have, however, managed to dump the internal ROM by running code which does a 'lda $b000, x' for each byte. This produces a unique access pattern which I can see with the signal analyser. Turns out that in addition to the SPI external flash, you can map a 32kB internal ROM into the same window --- this in addition to the (probably multiple) banks of other internal ROM. AFAICT everything from $0b00 to $ffff can be executable code.

4 bit or 4 shades? I believe the original Gameboy design rastered one pass of one bitmap and then two passes of another bitmap. This created a planar bitmap display with 4 shades. The technique can be extended but it requires an LCD with a very high frame rate and more processing power to update the bitmaps.



It might be doing something really odd like 4*8 pixel tiles. That would be an 8 bit to 32 pixel mapping. That would be sufficient to render a pseudo-proportional font and leave enough tiles to make pictures. In particular, if a tile is split into 4*4 pixel blocks and each block is split into two triangles with one orientation then 16 representations are required. If the triangles have multiple orientations then less than 64 representations are required.



Is I/O partially decoded? It might appear in both places but the IDE defaults to the last echo.



Note to self: Computer should make sheep noises and perform text to speech.

_________________
Modules | Processors | Boards | Boxes | Beep, Beep! I'm a sheep!

It's been a while, but I've made progress!

https://www.youtube.com/watch?v=42vNv6-U2L4

Brilliant! I'd like to hear more about the diagnostics and how you made use of them.

(Also, any chance of a transcription of your text in that video? As a pinned comment maybe??)